Agents can't manage CI secrets without the web UI. atgc secret set/list/delete would use org.tangled.secret.{add,list,remove}Secret. The secret's value would come from stdin or a file, never from argv.
Needs a decision: this needs a new OAuth scope, and it lets agents write CI secrets.